diff --git a/ext.php b/ext.php
index 56f2872..c6d4f70 100644
--- a/ext.php
+++ b/ext.php
@@ -78,7 +78,7 @@ protected function check_phpbb_version()
 	 */
 	protected function check_php_version()
 	{
-		if (phpbb_version_compare(PHP_VERSION_ID, '70300', '<'))
+		if (PHP_VERSION_ID < 70300)
 		{
 			$this->errors[] = 'PHP_VERSION_ERROR';
 		}
diff --git a/package.json b/package.json
index c366bf5..8e37252 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,5 @@
 {
+	"private": true,
 	"name": "phpbb-web-push-notifications",
 	"author": "phpBB Limited",
 	"license": "GPL-2.0",
diff --git a/styles/all/template/ucp_notifications_webpush.html b/styles/all/template/ucp_notifications_webpush.html
index 2967f1f..38929ef 100644
--- a/styles/all/template/ucp_notifications_webpush.html
+++ b/styles/all/template/ucp_notifications_webpush.html
@@ -1,21 +1,21 @@
 <script>
 	phpbbWebpushOptions = {
-		serviceWorkerUrl: '{{ U_WEBPUSH_WORKER_URL }}',
-		subscribeUrl: '{{ U_WEBPUSH_SUBSCRIBE }}',
-		unsubscribeUrl: '{{ U_WEBPUSH_UNSUBSCRIBE }}',
-		togglePopupUrl: '{{ U_WEBPUSH_TOGGLE_POPUP }}',
+		serviceWorkerUrl: '{{ U_WEBPUSH_WORKER_URL|e('js') }}',
+		subscribeUrl: '{{ U_WEBPUSH_SUBSCRIBE|e('js') }}',
+		unsubscribeUrl: '{{ U_WEBPUSH_UNSUBSCRIBE|e('js') }}',
+		togglePopupUrl: '{{ U_WEBPUSH_TOGGLE_POPUP|e('js') }}',
 		ajaxErrorTitle: '{{ lang_js('AJAX_ERROR_TITLE') }}',
-		vapidPublicKey: '{{ VAPID_PUBLIC_KEY }}',
+		vapidPublicKey: '{{ VAPID_PUBLIC_KEY|e('js') }}',
 		formTokens: {
-			creationTime: '{{ WEBPUSH_FORM_TOKENS.creation_time }}',
-			formToken: '{{ WEBPUSH_FORM_TOKENS.form_token }}',
+			creationTime: {{ WEBPUSH_FORM_TOKENS.creation_time|int }},
+			formToken: '{{ WEBPUSH_FORM_TOKENS.form_token|e('js') }}',
 		},
 		subscriptions: [
 		{% for sub in SUBSCRIPTIONS %}
-			{endpoint: '{{ sub.endpoint }}', expiration: '{{ sub.expiration }}' },
+			{endpoint: '{{ sub.endpoint|e('js') }}', expirationTime: {{ sub.expirationTime|int }} },
 		{% endfor %}
 		],
-	}
+	};
 </script>
 
 {% INCLUDEJS '@phpbb_webpushnotifications/webpush.js' %}
diff --git a/ucp/controller/webpush.php b/ucp/controller/webpush.php
index 2affea5..103688f 100644
--- a/ucp/controller/webpush.php
+++ b/ucp/controller/webpush.php
@@ -222,7 +222,7 @@ private function get_anonymous_notifications(): string
 			$user_lang = $row['user_lang'];
 
 			$expected_push_token = hash('sha256', $user_form_token . $push_token);
-			if ($expected_push_token === $token)
+			if (hash_equals($expected_push_token, $token))
 			{
 				if ($user_lang !== $this->language->get_used_language())
 				{